An investigation can lose the most useful origin evidence before technical examination begins. A screenshot of a message, a downloaded preview or a recompressed export may retain the visible allegation while discarding the source file’s metadata, provenance manifest and measurable image detail. Preserve the earliest available file and the route by which it was obtained, then identify every derivative separately.
Define the allegation before choosing a test
Ask what is disputed. Is the whole image alleged to be synthetic? Is a person said to have been inserted into otherwise camera-recorded media? Is the dispute over the date, location, source account or truth of the scene? These propositions require different material and methods. An AI-image classifier may be relevant to whole-image origin but unhelpful for a false caption. A sensor-origin measurement may address camera capture yet leave a local edit unresolved.
The original bytes and acquisition context should be retained. Record the source system, retrieval method, time, filenames, hashes where appropriate and any processing needed for viewing. Keep versions produced by messaging, social platforms or case systems as distinct objects. NIST’s evidence-preservation guidance is relevant here: integrity of a preserved copy is meaningful only when the scope and source of that copy are known.
Reconstruct the file’s history
Examine metadata in context, including software tags and signs of resaving. If Content Credentials are present, validate the C2PA binding and signature, identify the signer and read the actual assertions and ingredient history. If they are absent, document the absence in the supplied object and investigate whether an earlier version or external manifest exists. The C2PA specification describes signed provenance claims; a missing claim does not classify the file as synthetic.
Transformations belong in the analysis. Cropping, resizing, platform compression, screenshots and photographing a display can each change the relationship between the current pixels and the process that first created the depicted content. Where a transformation history is uncertain, test conclusions against plausible alternatives instead of assuming the supplied file is an untouched original.
Examine and report at the right level
Select examination methods by the proposition and the material. A visual anomaly can guide investigation, but should not be converted into a categorical origin opinion. A statistical detector needs relevant validation and stated error rates. For still-image origin, SPOT—Sensor Pattern Origin Testing investigates whether measured noise-residue characteristics favour physical camera capture or synthetic generation under defined models. Its published experimental population and limitations must be considered before applying an inference to case material.
Separate origin from human attribution. Even a strong result about image formation does not identify the person who created, posted or knew about the image. Account records, device artefacts and testimony may bear on those different questions. The same separation applies to scene truth: a physical camera can record a staged event or a displayed synthetic picture.
A useful report states the material examined, any unavailable source material, the competing propositions, each observation, the method’s tested scope and the strength of the supported inference. It should distinguish a negative test result from a test that could not discriminate. When compression or uncertain provenance makes the latter more likely, preserving that uncertainty is part of the finding.